Agent Skills: review-threat-model

Review, create, update, or audit a repo-specific security threat model (docs/threat-model.md) — map trust boundaries, assets, entry points, and attacker capabilities, then enumerate concrete abuse paths with likelihood and impact. Use when the user wants a threat model, STRIDE analysis, attack-surface review, security design review, abuse-case enumeration, or ISO 27001 secure-development (A.8.25 / A.8.27 / A.8.28) evidence. Grounds every threat in actual code; creates the doc if missing, updates it if present.